Drupal runs on PHP, so a Drupal site is affected by PHP2Shell if its server runs PHP older than the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Updating Drupal itself doesn't fix it; your host or developer updates PHP. Drupal 10 requires at least PHP 8.1; Drupal 11.1 to 11.4 support PHP 8.3 and 8.4.
- Drupal runs on PHP
- Yes
- newest fixed release
- 8.5.12
Is Drupal affected by PHP2Shell?
Drupal is written in PHP. Each Drupal major version supports a range of PHP versions, so a PHP update sometimes needs a Drupal update first. PHP2Shell is a flaw in PHP itself, not in Drupal, so updating Drupal or its plugins doesn't fix it. A Drupal site is affected if its server runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), released October 21, 2026.
How to see your PHP version in Drupal
- Log in as an administrator.
- Open Reports, then Status report.
- The PHP line shows the version, and Drupal warns there when your PHP is too old.
Who updates PHP for a Drupal site
Your host on managed or shared hosting, your developer on your own server. Drupal-specialist hosts such as Pantheon manage PHP for you.
Guides for common hosts: cPanel, Plesk, Cloudways.
Which PHP version Drupal supports
Drupal 10 requires at least PHP 8.1; Drupal 11.1 to 11.4 support PHP 8.3 and 8.4. Whatever the line, use its newest release: for PHP2Shell that means 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
What PHP Scanner looks for on a Drupal site
PHP Scanner recognizes Drupal from a page generator tag naming Drupal, Drupal headers such as X-Generator or X-Drupal-Cache, Drupal settings in the page, a Drupal session cookie, files under /sites/default/files/. Many Drupal servers hide their PHP version, which is good practice; then your result asks you to paste the version from the steps above for an exact rating.
Questions people ask
Is my Drupal site safe from PHP2Shell?
No outside check can promise that. What you can confirm is that its PHP is a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) or newer. If it is, PHP2Shell's fix is in.
Does updating Drupal fix PHP2Shell?
No. PHP2Shell is in PHP, which your host or developer updates. Keep Drupal updated as well, but it's a separate job.
What PHP version should Drupal run?
Drupal 10 requires at least PHP 8.1; Drupal 11.1 to 11.4 support PHP 8.3 and 8.4. Use the newest release of whichever line you're on.
My host says PHP is up to date but the version looks old. Why?
Some hosts and Linux distributions add security fixes without changing the version number. Ask your host to confirm in writing that the PHP2Shell fix is applied.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.